Field
This invention relates generally to data networking, and more specifically, to a system and method to apply a network traffic policy based on a user identity during an application session.
Related Art
The secure data network of a company is a critical component for day-to-day functioning of company business activities. Company employees access the secure data network for communication within the company and with the outside world. Company information, oftentimes proprietary or confidential, is exchanged during the communication.
Typically, an employee gains access to the company's secure data network by means of a network logon procedure using a private user identity, such as a user name “Robert P. Williamson” or an employee number “NG01-60410”. Subsequent information exchange using the company's office applications, such as email, file transfer or document control is traceable based on the private user identity through network event logs.
Since the late 1990's, we have been witnessing the phenomenal rising popularity of public communication applications and services, such as email and Instant Messaging offered by Yahoo™, America Online™ (AOL), or Google™, conferencing and collaboration services offered by WebEx™ or Centra™, or peer-to-peer services for a variety of file sharing. Generally, a public communication service allows a user to exchange information through messaging, text chat or document exchange using a public user identity, such as “butterdragon”, “fingernailI984”, or “peterrabbit”.
However, in a company setting, when an employee connects to a public communication service with a public user identity over the company's secure data network, the information exchange is not easily traceable if at all since the public user identity is not tied to the private user identity.
In one example, a company's information technology (IT) department notices that an employee Victor has been using the company's email system to send out proprietary documents, violating the company's security policy. After issuing a warning to Victor, the IT department finds no further violations. Unfortunately, they are not aware of the fact that Victor has continued this activity using Yahoo™ email with a public user identity “PiratesOfCaribbean@Yahoo.com”.
In another example, two weeks before a major trade show, a company implements a security measure to monitor communication activities of employees of director level and above to ensure confidentiality of competitive information. This security measure, covering company email, phone conversation and voice messaging, nevertheless proves to be a failure as sensitive information leaks out to a business reporter anyway prior to the trade show. The source of the leak may never be confirmed, but the business reporter privately discloses that he gets the information from an anonymous employee of the company using AOL Instant Messaging™ with screen name “opensecret2006”.
In addition to associating a user identity to an application session, the company often desires to handle the network traffic of the associated application session in a control or isolated manner.
The above discussion illustrates a need for a security driven packet forwarding solution to associate a user identity to an application.